Tech E&O covers claims arising from failures in your software or professional services. If your platform goes down and a customer loses revenue, or if a bug in your code causes data corruption, Tech E&O is the coverage grant that responds. This is distinct from cyber liability, which focuses on data breaches and network security events.

For SaaS companies, the line between Tech E&O and cyber liability blurs frequently. A ransomware attack that takes your platform offline triggers both a cyber event and a service failure. The policy forms need to work together without gaps or overlapping exclusions. Bloc Cyber structures placements at the insuring-agreement level specifically to prevent these gaps, reviewing how each coverage grant interacts before binding.

General liability policies cover bodily injury and property damage. They do not cover data breaches, software failures, or regulatory defense costs. A commercial general liability form will almost certainly contain an electronic data exclusion, a professional services exclusion, or both.

Cyber liability insurance addresses first-party costs (forensic investigation, notification, credit monitoring, business interruption) and third-party claims (lawsuits from affected individuals, regulatory actions, payment card industry fines). SaaS companies operating in Illinois need both cyber liability and Tech E&O, and they need them structured as complementary forms rather than conflicting ones.

Most enterprise SaaS contracts include mutual indemnification provisions, with a carve-out for data breaches and intellectual property infringement that often removes liability caps entirely. This means your exposure on a single customer contract can exceed the total contract value by orders of magnitude.

Your insurance limits need to reflect this uncapped exposure, not just the revenue from the contract. A $1 million cyber policy may seem adequate until a breach triggers indemnification obligations across multiple customer agreements simultaneously. Reviewing indemnification language against your policy's insuring agreements before signing the contract is the only way to confirm alignment.

Enterprise buyers typically require you to maintain specific minimum security controls as a condition of the contract and, increasingly, as a condition of your insurance. These controls often include:

• 
  
• Multi-factor authentication on all administrative access
• Endpoint detection and response across all company devices
• Encrypted backups stored separately from production systems
• A documented incident response plan tested within the past 12 months
• SOC 2 Type II certification or equivalent third-party audit

Failing to maintain these controls can void your insurance coverage through a material misrepresentation on the application, and it can simultaneously breach your customer contract. The overlap between insurer requirements and customer requirements is not coincidental: both parties are trying to reduce the same risk.

BIPA has been the single largest driver of privacy litigation in the United States. Illinois Senate Bill 2979 reduced liability by clarifying that violations occur once per person rather than per scan, which has meaningfully changed the risk calculus for both insureds and carriers. The Seventh Circuit has confirmed that this amendment applies retroactively, reducing exposure for pending claims as well.

That said, if your SaaS platform collects or processes biometric data, including facial recognition, fingerprint scanning, or voiceprint analysis, underwriters will scrutinize your consent mechanisms, data retention policies, and deletion protocols. BIPA compliance is now a threshold underwriting question for any Illinois technology company.